Background

https://www.fireeyesolution.com/research/2009/03/a-new-method-to-monetize-scareware.html

http://voices.washingtonpost.com/securityfix/2009/03/antivirus2009_holds_victims_do.html

Exposition

The Filefix Professional 2009 (wizard.exe) demo
version will uncorrupt (read: decrypt) one file. Which means that
I can learn everything I need to know to decrypt all files from analyzing
just this binary itself.

So, where to start looking? Well a file decryption routine is going to
need to read and write files, so search for calls to ReadFile.
Almost the first thing I find is a loop that calls ReadFile,
has an inner loop that XOR's over each byte in the buffer, and
then calls WriteFile. Hmmm… (See appendix.)

Now all I need are some encrypted files. Filefix Pro doesn't encrypt
anything itself, and I didn't have a sample of the malware which did.
Fortunately (for me), we were in contact with some of the victims, so as
soon as I had some samples it confirmed my suspicion about the encryption just being
ECB-XOR. The only thing which took me more than a minute to figure out was
that the crypto key was stored at the end of the file. (Since I had already
figured out how to decrypt it without knowing the key.)

Spending a little more time reading the binary, I also found the routine
which checks for valid keys at the ends of files. This allows Filefix to tell
corrupt and non-corrupt files apart when scanning the disk. There is a
strict mathematical relationship between the four bytes of the key.
Implemented as three simple boolean tests. If you do the math, this
also means that there are only 256 possible valid keys.

Continue reading »